Signed metadata settings

Open a hosted authorization server and choose Settings, then Signed metadata. Enable signed metadata only after the resource has a valid signing configuration.

The signing screen may store a typed KMS resource handle as a platform configuration binding, together with the provider-native key alias, purpose, and supported algorithm. That handle is not the tenant runtime KMS API: tenant cryptographic REST operations select the provider with providerId and the key or certificate with its provider-native alias. Private key material is never accepted by Platform Config and is never returned by the Admin Console. The selected key must remain tenant owned and suitable for token or metadata signing as required by the configured feature.

The hosted configuration and signing resource are revision guarded. If a key is rotated, validate the new public metadata and downstream trust configuration before retiring the prior key.

Signed-metadata settings are fields of the aggregate hosted configuration below the selected UUID:

GET /api/platform/config/v1/tenants/{tenantId}/authorization-servers/{authorizationServerId}/configuration
PUT /api/platform/config/v1/tenants/{tenantId}/authorization-servers/{authorizationServerId}/configuration